1 typedef struct _IMAGE_DOS_HEADER
{ // DOS .EXE header
2 WORD e_magic
; // Magic number
3 WORD e_cblp
; // Bytes on last page of file
4 WORD e_cp
; // Pages in file
5 WORD e_crlc
; // Relocations
6 WORD e_cparhdr
; // Size of header in paragraphs
7 WORD e_minalloc
; // Minimum extra paragraphs needed
8 WORD e_maxalloc
; // Maximum extra paragraphs needed
9 WORD e_ss
; // Initial (relative) SS value
10 WORD e_sp
; // Initial SP value
11 WORD e_csum
; // Checksum
12 WORD e_ip
; // Initial IP value
13 WORD e_cs
; // Initial (relative) CS value
14 WORD e_lfarlc
; // File address of relocation table
15 WORD e_ovno
; // Overlay number
16 WORD e_res
[4]; // Reserved words
17 WORD e_oemid
; // OEM identifier (for e_oeminfo)
18 WORD e_oeminfo
; // OEM information; e_oemid specific
19 WORD e_res2
[10]; // Reserved words
20 LONG e_lfanew
; // File address of new exe header
21 } IMAGE_DOS_HEADER
, *PIMAGE_DOS_HEADER
;
23 typedef struct _IMAGE_FILE_HEADER
{
25 WORD NumberOfSections
;
27 DWORD PointerToSymbolTable
;
28 DWORD NumberOfSymbols
;
29 WORD SizeOfOptionalHeader
;
31 } IMAGE_FILE_HEADER
, *PIMAGE_FILE_HEADER
;
33 #define IMAGE_SIZEOF_FILE_HEADER 20
35 #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.
36 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved externel references).
37 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.
38 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.
39 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.
40 #define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.
41 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file
42 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.
43 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.
44 #define IMAGE_FILE_SYSTEM 0x1000 // System File.
45 #define IMAGE_FILE_DLL 0x2000 // File is a DLL.
46 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine
47 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.
49 #define IMAGE_FILE_MACHINE_UNKNOWN 0
50 #define IMAGE_FILE_MACHINE_I386 0x14c // Intel 386.
51 #define IMAGE_FILE_MACHINE_R3000 0x162 // MIPS little-endian, 0x160 big-endian
52 #define IMAGE_FILE_MACHINE_R4000 0x166 // MIPS little-endian
53 #define IMAGE_FILE_MACHINE_R10000 0x168 // MIPS little-endian
54 #define IMAGE_FILE_MACHINE_ALPHA 0x184 // Alpha_AXP
55 #define IMAGE_FILE_MACHINE_POWERPC 0x1F0 // IBM PowerPC Little-Endian
62 typedef struct _IMAGE_DATA_DIRECTORY
{
65 } IMAGE_DATA_DIRECTORY
, *PIMAGE_DATA_DIRECTORY
;
67 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
70 // Optional header format.
73 typedef struct _IMAGE_OPTIONAL_HEADER
{
79 BYTE MajorLinkerVersion
;
80 BYTE MinorLinkerVersion
;
82 DWORD SizeOfInitializedData
;
83 DWORD SizeOfUninitializedData
;
84 DWORD AddressOfEntryPoint
;
89 // NT additional fields.
93 DWORD SectionAlignment
;
95 WORD MajorOperatingSystemVersion
;
96 WORD MinorOperatingSystemVersion
;
97 WORD MajorImageVersion
;
98 WORD MinorImageVersion
;
99 WORD MajorSubsystemVersion
;
100 WORD MinorSubsystemVersion
;
101 DWORD Win32VersionValue
;
106 WORD DllCharacteristics
;
107 DWORD SizeOfStackReserve
;
108 DWORD SizeOfStackCommit
;
109 DWORD SizeOfHeapReserve
;
110 DWORD SizeOfHeapCommit
;
112 DWORD NumberOfRvaAndSizes
;
113 IMAGE_DATA_DIRECTORY DataDirectory
[IMAGE_NUMBEROF_DIRECTORY_ENTRIES
];
114 } IMAGE_OPTIONAL_HEADER
, *PIMAGE_OPTIONAL_HEADER
;
117 typedef struct _IMAGE_NT_HEADERS
{
119 IMAGE_FILE_HEADER FileHeader
;
120 IMAGE_OPTIONAL_HEADER OptionalHeader
;
121 } IMAGE_NT_HEADERS
, *PIMAGE_NT_HEADERS
;
126 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
127 #define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
128 #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
129 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
130 #define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
131 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
132 #define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
133 #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // Description String
134 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // Machine Value (MIPS GP)
135 #define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
136 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
137 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
138 #define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table
141 // Section header format.
144 #define IMAGE_SIZEOF_SHORT_NAME 8
146 typedef struct _IMAGE_SECTION_HEADER
{
147 BYTE Name
[IMAGE_SIZEOF_SHORT_NAME
];
149 DWORD PhysicalAddress
;
152 DWORD VirtualAddress
;
154 DWORD PointerToRawData
;
155 DWORD PointerToRelocations
;
156 DWORD PointerToLinenumbers
;
157 WORD NumberOfRelocations
;
158 WORD NumberOfLinenumbers
;
159 DWORD Characteristics
;
160 } IMAGE_SECTION_HEADER
, *PIMAGE_SECTION_HEADER
;
162 #define IMAGE_SIZEOF_SECTION_HEADER 40
169 typedef struct _IMAGE_EXPORT_DIRECTORY
{
170 DWORD Characteristics
;
176 DWORD NumberOfFunctions
;
178 PDWORD
*AddressOfFunctions
;
179 PDWORD
*AddressOfNames
;
180 PWORD
*AddressOfNameOrdinals
;
181 } IMAGE_EXPORT_DIRECTORY
, *PIMAGE_EXPORT_DIRECTORY
;
187 typedef struct _IMAGE_IMPORT_BY_NAME
{
190 } IMAGE_IMPORT_BY_NAME
, *PIMAGE_IMPORT_BY_NAME
;
192 #define IMAGE_ORDINAL_FLAG 0x80000000
193 #define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
201 // Resource directory consists of two counts, following by a variable length
202 // array of directory entries. The first count is the number of entries at
203 // beginning of the array that have actual names associated with each entry.
204 // The entries are in ascending order, case insensitive strings. The second
205 // count is the number of entries that immediately follow the named entries.
206 // This second count identifies the number of entries that have 16-bit integer
207 // Ids as their name. These entries are also sorted in ascending order.
209 // This structure allows fast lookup by either name or number, but for any
210 // given resource entry only one form of lookup is supported, not both.
211 // This is consistant with the syntax of the .RC file and the .RES file.
214 // Predefined resource types ... there may be some more, but I don't have
215 // the information yet. .....sang cho.....
217 #define RT_NEWRESOURCE 0x2000
218 #define RT_ERROR 0x7fff
227 #define RT_ACCELERATORS 9
229 #define RT_MESSAGETABLE 11
230 #define RT_GROUP_CURSOR 12
231 #define RT_GROUP_ICON 14
232 #define RT_VERSION 16
233 #define NEWBITMAP (RT_BITMAP|RT_NEWRESOURCE)
234 #define NEWMENU (RT_MENU|RT_NEWRESOURCE)
235 #define NEWDIALOG (RT_DIALOG|RT_NEWRESOURCE)
238 typedef struct _IMAGE_RESOURCE_DIRECTORY
{
239 DWORD Characteristics
;
243 WORD NumberOfNamedEntries
;
244 WORD NumberOfIdEntries
;
245 // IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[1];
246 } IMAGE_RESOURCE_DIRECTORY
, *PIMAGE_RESOURCE_DIRECTORY
;
248 #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
249 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000
252 // Each directory contains the 32-bit Name of the entry and an offset,
253 // relative to the beginning of the resource directory of the data associated
254 // with this directory entry. If the name of the entry is an actual text
255 // string instead of an integer Id, then the high order bit of the name field
256 // is set to one and the low order 31-bits are an offset, relative to the
257 // beginning of the resource directory of the string, which is of type
258 // IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
259 // low-order 16-bits are the integer Id that identify this resource directory
260 // entry. If the directory entry is yet another resource directory (i.e. a
261 // subdirectory), then the high order bit of the offset field will be
262 // set to indicate this. Otherwise the high bit is clear and the offset
263 // field points to a resource data entry.
266 typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
{
269 } IMAGE_RESOURCE_DIRECTORY_ENTRY
, *PIMAGE_RESOURCE_DIRECTORY_ENTRY
;
272 // For resource directory entries that have actual string names, the Name
273 // field of the directory entry points to an object of the following type.
274 // All of these string objects are stored together after the last resource
275 // directory entry and before the first resource data object. This minimizes
276 // the impact of these variable length objects on the alignment of the fixed
277 // size directory entry objects.
280 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
{
282 CHAR NameString
[ 1 ];
283 } IMAGE_RESOURCE_DIRECTORY_STRING
, *PIMAGE_RESOURCE_DIRECTORY_STRING
;
286 typedef struct _IMAGE_RESOURCE_DIR_STRING_U
{
288 WCHAR NameString
[ 1 ];
289 } IMAGE_RESOURCE_DIR_STRING_U
, *PIMAGE_RESOURCE_DIR_STRING_U
;
293 // Each resource data entry describes a leaf node in the resource directory
294 // tree. It contains an offset, relative to the beginning of the resource
295 // directory of the data for the resource, a size field that gives the number
296 // of bytes of data at that offset, a CodePage that should be used when
297 // decoding code point values within the resource data. Typically for new
298 // applications the code page would be the unicode code page.
301 typedef struct _IMAGE_RESOURCE_DATA_ENTRY
{
306 } IMAGE_RESOURCE_DATA_ENTRY
, *PIMAGE_RESOURCE_DATA_ENTRY
;
309 // Menu Resources ... added by .....sang cho....
311 // Menu resources are composed of a menu header followed by a sequential list
312 // of menu items. There are two types of menu items: pop-ups and normal menu
313 // itmes. The MENUITEM SEPARATOR is a special case of a normal menu item with
314 // an empty name, zero ID, and zero flags.
316 typedef struct _IMAGE_MENU_HEADER
{
317 WORD wVersion
; // Currently zero
318 WORD cbHeaderSize
; // Also zero
319 } IMAGE_MENU_HEADER
, *PIMAGE_MENU_HEADER
;
321 typedef struct _IMAGE_POPUP_MENU_ITEM
{
324 } IMAGE_POPUP_MENU_ITEM
, *PIMAGE_POPUP_MENU_ITEM
;
326 typedef struct _IMAGE_NORMAL_MENU_ITEM
{
330 } IMAGE_NORMAL_MENU_ITEM
, *PIMAGE_NORMAL_MENU_ITEM
;
332 #define GRAYED 0x0001 // GRAYED keyword
333 #define INACTIVE 0x0002 // INACTIVE keyword
334 #define BITMAP 0x0004 // BITMAP keyword
335 #define OWNERDRAW 0x0100 // OWNERDRAW keyword
336 #define CHECKED 0x0008 // CHECKED keyword
337 #define POPUP 0x0010 // used internally
338 #define MENUBARBREAK 0x0020 // MENUBARBREAK keyword
339 #define MENUBREAK 0x0040 // MENUBREAK keyword
340 #define ENDMENU 0x0080 // used internally
343 // Dialog Box Resources .................. added by sang cho.
345 // A dialog box is contained in a single resource and has a header and
346 // a portion repeated for each control in the dialog box.
347 // The item DWORD IStyle is a standard window style composed of flags found
349 // The default style for a dialog box is:
350 // WS_POPUP | WS_BORDER | WS_SYSMENU
352 // The itme marked "Name or Ordinal" are :
353 // If the first word is an 0xffff, the next two bytes contain an ordinal ID.
354 // Otherwise, the first one or more WORDS contain a double-null-terminated string.
355 // An empty string is represented by a single WORD zero in the first location.
357 // The WORD wPointSize and WCHAR szFontName entries are present if the FONT
358 // statement was included for the dialog box. This can be detected by checking
359 // the entry IStyle. If IStyle & DS_SETFONT ( which is 0x40), then these
360 // entries will be present.
362 typedef struct _IMAGE_DIALOG_BOX_HEADER1
{
364 DWORD IExtendedStyle
; // New for Windows NT
365 WORD nControls
; // Number of Controls
370 // N_OR_O MenuName; // Name or Ordinal ID
371 // N_OR_O ClassName; // Name or Ordinal ID
372 // WCHAR szCaption[];
373 // WORD wPointSize; // Only here if FONT set for dialog
374 // WCHAR szFontName[]; // This too
375 } IMAGE_DIALOG_HEADER
, *PIMAGE_DIALOG_HEADER
;
377 typedef union _NAME_OR_ORDINAL
{ // Name or Ordinal ID
383 } NAME_OR_ORDINAL
, *PNAME_OR_ORDINAL
;
385 // The data for each control starts on a DWORD boundary (which may require
386 // some padding from the previous control), and its format is as follows:
388 typedef struct _IMAGE_CONTROL_DATA
{
390 DWORD IExtendedStyle
;
399 } IMAGE_CONTROL_DATA
, *PIMAGE_CONTROL_DATA
;
405 #define SCROLLBAR 0x84
406 #define COMBOBOX 0x85
408 // The various statements used in a dialog script are all mapped to these
409 // classes along with certain modifying styles. The values for these styles
410 // can be found in WINDOWS.H. All dialog controls have the default styles
411 // of WS_CHILD and WS_VISIBLE. A list of the default styles used follows:
413 // Statement Default Class Default Styles
414 // CONTROL None WS_CHILD|WS_VISIBLE
415 // LTEXT STATIC ES_LEFT
416 // RTEXT STATIC ES_RIGHT
417 // CTEXT STATIC ES_CENTER
418 // LISTBOX LISTBOX WS_BORDER|LBS_NOTIFY
419 // CHECKBOX BUTTON BS_CHECKBOX|WS_TABSTOP
420 // PUSHBUTTON BUTTON BS_PUSHBUTTON|WS_TABSTOP
421 // GROUPBOX BUTTON BS_GROUPBOX
422 // DEFPUSHBUTTON BUTTON BS_DFPUSHBUTTON|WS_TABSTOP
423 // RADIOBUTTON BUTTON BS_RADIOBUTTON
424 // AUTOCHECKBOX BUTTON BS_AUTOCHECKBOX
425 // AUTO3STATE BUTTON BS_AUTO3STATE
426 // AUTORADIOBUTTON BUTTON BS_AUTORADIOBUTTON
427 // PUSHBOX BUTTON BS_PUSHBOX
428 // STATE3 BUTTON BS_3STATE
429 // EDITTEXT EDIT ES_LEFT|WS_BORDER|WS_TABSTOP
430 // COMBOBOX COMBOBOX None
431 // ICON STATIC SS_ICON
432 // SCROLLBAR SCROLLBAR None
435 #define WS_OVERLAPPED 0x00000000L
436 #define WS_POPUP 0x80000000L
437 #define WS_CHILD 0x40000000L
438 #define WS_CLIPSIBLINGS 0x04000000L
439 #define WS_CLIPCHILDREN 0x02000000L
440 #define WS_VISIBLE 0x10000000L
441 #define WS_DISABLED 0x08000000L
442 #define WS_MINIMIZE 0x20000000L
443 #define WS_MAXIMIZE 0x01000000L
444 #define WS_CAPTION 0x00C00000L
445 #define WS_BORDER 0x00800000L
446 #define WS_DLGFRAME 0x00400000L
447 #define WS_VSCROLL 0x00200000L
448 #define WS_HSCROLL 0x00100000L
449 #define WS_SYSMENU 0x00080000L
450 #define WS_THICKFRAME 0x00040000L
451 #define WS_MINIMIZEBOX 0x00020000L
452 #define WS_MAXIMIZEBOX 0x00010000L
453 #define WS_GROUP 0x00020000L
454 #define WS_TABSTOP 0x00010000L
457 #define WS_OVERLAPPEDWINDOW (WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME | WS_MINIMIZEBOX | WS_MAXIMIZEBOX)
458 #define WS_POPUPWINDOW (WS_POPUP | WS_BORDER | WS_SYSMENU)
459 #define WS_CHILDWINDOW (WS_CHILD)
460 #define WS_TILED WS_OVERLAPPED
461 #define WS_ICONIC WS_MINIMIZE
462 #define WS_SIZEBOX WS_THICKFRAME
463 #define WS_TILEDWINDOW WS_OVERLAPPEDWINDOW
465 #define WS_EX_DLGMODALFRAME 0x00000001L
466 #define WS_EX_NOPARENTNOTIFY 0x00000004L
467 #define WS_EX_TOPMOST 0x00000008L
468 #define WS_EX_ACCEPTFILES 0x00000010L
469 #define WS_EX_TRANSPARENT 0x00000020L
471 #define BS_PUSHBUTTON 0x00000000L
472 #define BS_DEFPUSHBUTTON 0x00000001L
473 #define BS_CHECKBOX 0x00000002L
474 #define BS_AUTOCHECKBOX 0x00000003L
475 #define BS_RADIOBUTTON 0x00000004L
476 #define BS_3STATE 0x00000005L
477 #define BS_AUTO3STATE 0x00000006L
478 #define BS_GROUPBOX 0x00000007L
479 #define BS_USERBUTTON 0x00000008L
480 #define BS_AUTORADIOBUTTON 0x00000009L
481 #define BS_OWNERDRAW 0x0000000BL
482 #define BS_LEFTTEXT 0x00000020L
484 #define ES_LEFT 0x00000000L
485 #define ES_CENTER 0x00000001L
486 #define ES_RIGHT 0x00000002L
487 #define ES_MULTILINE 0x00000004L
488 #define ES_UPPERCASE 0x00000008L
489 #define ES_LOWERCASE 0x00000010L
490 #define ES_PASSWORD 0x00000020L
491 #define ES_AUTOVSCROLL 0x00000040L
492 #define ES_AUTOHSCROLL 0x00000080L
493 #define ES_NOHIDESEL 0x00000100L
494 #define ES_OEMCONVERT 0x00000400L
495 #define ES_READONLY 0x00000800L
496 #define ES_WANTRETURN 0x00001000L
498 #define LBS_NOTIFY 0x0001L
499 #define LBS_SORT 0x0002L
500 #define LBS_NOREDRAW 0x0004L
501 #define LBS_MULTIPLESEL 0x0008L
502 #define LBS_OWNERDRAWFIXED 0x0010L
503 #define LBS_OWNERDRAWVARIABLE 0x0020L
504 #define LBS_HASSTRINGS 0x0040L
505 #define LBS_USETABSTOPS 0x0080L
506 #define LBS_NOINTEGRALHEIGHT 0x0100L
507 #define LBS_MULTICOLUMN 0x0200L
508 #define LBS_WANTKEYBOARDINPUT 0x0400L
509 #define LBS_EXTENDEDSEL 0x0800L
510 #define LBS_DISABLENOSCROLL 0x1000L
512 #define SS_LEFT 0x00000000L
513 #define SS_CENTER 0x00000001L
514 #define SS_RIGHT 0x00000002L
515 #define SS_ICON 0x00000003L
516 #define SS_BLACKRECT 0x00000004L
517 #define SS_GRAYRECT 0x00000005L
518 #define SS_WHITERECT 0x00000006L
519 #define SS_BLACKFRAME 0x00000007L
520 #define SS_GRAYFRAME 0x00000008L
521 #define SS_WHITEFRAME 0x00000009L
522 #define SS_SIMPLE 0x0000000BL
523 #define SS_LEFTNOWORDWRAP 0x0000000CL
524 #define SS_BITMAP 0x0000000EL
530 typedef struct _IMAGE_DEBUG_DIRECTORY
{
531 DWORD Characteristics
;
537 DWORD AddressOfRawData
;
538 DWORD PointerToRawData
;
539 } IMAGE_DEBUG_DIRECTORY
, *PIMAGE_DEBUG_DIRECTORY
;
541 #define IMAGE_DEBUG_TYPE_UNKNOWN 0
542 #define IMAGE_DEBUG_TYPE_COFF 1
543 #define IMAGE_DEBUG_TYPE_CODEVIEW 2
544 #define IMAGE_DEBUG_TYPE_FPO 3
545 #define IMAGE_DEBUG_TYPE_MISC 4
546 #define IMAGE_DEBUG_TYPE_EXCEPTION 5
547 #define IMAGE_DEBUG_TYPE_FIXUP 6
548 #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC 7
549 #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC 8
552 typedef struct _IMAGE_DEBUG_MISC
{
553 DWORD DataType
; // type of misc data, see defines
554 DWORD Length
; // total length of record, rounded to four
556 BOOLEAN Unicode
; // TRUE if data is unicode string
558 BYTE Data
[ 1 ]; // Actual data
559 } IMAGE_DEBUG_MISC
, *PIMAGE_DEBUG_MISC
;
563 // Debugging information can be stripped from an image file and placed
564 // in a separate .DBG file, whose file name part is the same as the
565 // image file name part (e.g. symbols for CMD.EXE could be stripped
566 // and placed in CMD.DBG). This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
567 // flag in the Characteristics field of the file header. The beginning of
568 // the .DBG file contains the following structure which captures certain
569 // information from the image file. This allows a debug to proceed even if
570 // the original image file is not accessable. This header is followed by
571 // zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
572 // IMAGE_DEBUG_DIRECTORY structures. The latter structures and those in
573 // the image file contain file offsets relative to the beginning of the
576 // If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
577 // is left in the image file, but not mapped. This allows a debugger to
578 // compute the name of the .DBG file, from the name of the image in the
579 // IMAGE_DEBUG_MISC structure.
582 typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
{
586 WORD Characteristics
;
591 DWORD NumberOfSections
;
592 DWORD ExportedNamesSize
;
593 DWORD DebugDirectorySize
;
594 DWORD SectionAlignment
;
596 } IMAGE_SEPARATE_DEBUG_HEADER
, *PIMAGE_SEPARATE_DEBUG_HEADER
;
598 #define IMAGE_SEPARATE_DEBUG_SIGNATURE 0x4944
600 #define IMAGE_SEPARATE_DEBUG_FLAGS_MASK 0x8000
601 #define IMAGE_SEPARATE_DEBUG_MISMATCH 0x8000 // when DBG was updated, the
602 // old checksum didn't match.
610 #define SIZE_OF_NT_SIGNATURE sizeof (DWORD)
611 #define MAXRESOURCENAME 13
613 /* global macros to define header offsets into file */
614 /* offset to PE file signature */
615 #define NTSIGNATURE(a) ((LPVOID)((BYTE *)a + \
616 ((PIMAGE_DOS_HEADER)a)->e_lfanew))
618 /* DOS header identifies the NT PEFile signature dword
619 the PEFILE header exists just after that dword */
620 #define PEFHDROFFSET(a) ((LPVOID)((BYTE *)a + \
621 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
622 SIZE_OF_NT_SIGNATURE))
624 /* PE optional header is immediately after PEFile header */
625 #define OPTHDROFFSET(a) ((LPVOID)((BYTE *)a + \
626 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
627 SIZE_OF_NT_SIGNATURE + \
628 sizeof (IMAGE_FILE_HEADER)))
630 /* section headers are immediately after PE optional header */
631 #define SECHDROFFSET(a) ((LPVOID)((BYTE *)a + \
632 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
633 SIZE_OF_NT_SIGNATURE + \
634 sizeof (IMAGE_FILE_HEADER) + \
635 sizeof (IMAGE_OPTIONAL_HEADER)))
638 typedef struct tagImportDirectory
640 DWORD dwRVAFunctionNameList
;
643 DWORD dwRVAModuleName
;
644 DWORD dwRVAFunctionAddressList
;
645 }IMAGE_IMPORT_MODULE_DIRECTORY
, * PIMAGE_IMPORT_MODULE_DIRECTORY
;